Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 28 Packages Projects Releases Wiki Activity

Avoid unnecessary prepared statements in "select config from team" uncached queries (#30206)

Browse Source 
For #30199. This is one of a few approaches to mitigate the issue the
customer is seeing.

This is SQLi-safe because we're dealing with an unsigned int parameter,
sprintf'd %d. Existing tests fully cover this path.

# Checklist for submitter

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] Manual QA for all new/changed functionality
This commit is contained in:
Ian Littman
2025-06-23 21:09:55 -05:00
committed by GitHub
parent bc62898091
commit 2e58aabeee
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changes/30199-stmt-tweak
+1
View File
@@ -0,0 +1 @@
* Improved performance when pulling team settings on osquery config and distributed read endpoints
server/datastore/mysql/teams.go
+4 -4
View File
@@ -394,9 +394,9 @@ func amountTeamsDB(ctx context.Context, db sqlx.QueryerContext) (int, error) {
// TeamAgentOptions loads the agents options of a team.
func (ds *Datastore) TeamAgentOptions(ctx context.Context, tid uint) (*json.RawMessage, error) {
sql := `SELECT config->'$.agent_options' FROM teams WHERE id = ?`
stmt := fmt.Sprintf(`SELECT config->'$.agent_options' FROM teams WHERE id = %d`, tid) // safe because uint
var agentOptions *json.RawMessage
if err := sqlx.GetContext(ctx, ds.reader(ctx), &agentOptions, sql, tid); err != nil {
if err := sqlx.GetContext(ctx, ds.reader(ctx), &agentOptions, stmt); err != nil {
return nil, ctxerr.Wrap(ctx, err, "select team")
}
return agentOptions, nil
@@ -408,9 +408,9 @@ func (ds *Datastore) TeamFeatures(ctx context.Context, tid uint) (*fleet.Feature
}
func teamFeaturesDB(ctx context.Context, q sqlx.QueryerContext, tid uint) (*fleet.Features, error) {
sql := `SELECT config->'$.features' as features FROM teams WHERE id = ?`
stmt := fmt.Sprintf(`SELECT config->'$.features' as features FROM teams WHERE id = %d`, tid) // safe due to uint
var raw *json.RawMessage
if err := sqlx.GetContext(ctx, q, &raw, sql, tid); err != nil {
if err := sqlx.GetContext(ctx, q, &raw, stmt); err != nil {
return nil, ctxerr.Wrap(ctx, err, "get team config features")
}